From 02d8f3cdc806114e3ec0358ca2d696c62d438c00 Mon Sep 17 00:00:00 2001
From: Harshavardhana <harsha@minio.io>
Date: Sat, 29 Apr 2023 02:05:28 -0700
Subject: [PATCH] fix: remove active healing on .minio.sys/ during startup
 (#17072)

---
 cmd/admin-heal-ops.go | 5 +++++
 cmd/common-main.go    | 1 +
 cmd/config-migrate.go | 6 ++++++
 cmd/globals.go        | 3 +++
 4 files changed, 15 insertions(+)

diff --git a/cmd/admin-heal-ops.go b/cmd/admin-heal-ops.go
index 1af92237d..c5fb9e176 100644
--- a/cmd/admin-heal-ops.go
+++ b/cmd/admin-heal-ops.go
@@ -784,6 +784,11 @@ func (h *healSequence) healDiskMeta(objAPI ObjectLayer) error {
 }
 
 func (h *healSequence) healItems(objAPI ObjectLayer, bucketsOnly bool) error {
+	if h.clientToken == bgHealingUUID {
+		// For background heal do nothing.
+		return nil
+	}
+
 	if err := h.healDiskMeta(objAPI); err != nil {
 		return err
 	}
diff --git a/cmd/common-main.go b/cmd/common-main.go
index 65bd9c751..e15045c35 100644
--- a/cmd/common-main.go
+++ b/cmd/common-main.go
@@ -766,6 +766,7 @@ func handleCommonEnvVars() {
 			logger.Info(color.RedBold(msg))
 		}
 		globalActiveCred = cred
+		globalCredViaEnv = true
 	} else {
 		globalActiveCred = auth.DefaultCredentials
 	}
diff --git a/cmd/config-migrate.go b/cmd/config-migrate.go
index d52741db0..b65b68b51 100644
--- a/cmd/config-migrate.go
+++ b/cmd/config-migrate.go
@@ -2531,6 +2531,12 @@ func readConfigWithoutMigrate(ctx context.Context, objAPI ObjectLayer) (config.C
 		}
 	}
 
+	if !globalCredViaEnv && cfg.Credential.IsValid() {
+		// Preserve older credential if we do not have
+		// root credentials set via environment variable.
+		globalActiveCred = cfg.Credential
+	}
+
 	// Init compression config. For future migration, Compression config needs to be copied over from previous version.
 	switch cfg.Version {
 	case "29":
diff --git a/cmd/globals.go b/cmd/globals.go
index 3acf67791..01eb14256 100644
--- a/cmd/globals.go
+++ b/cmd/globals.go
@@ -254,6 +254,9 @@ var (
 
 	globalActiveCred auth.Credentials
 
+	// Captures if root credentials are set via ENV.
+	globalCredViaEnv bool
+
 	globalPublicCerts []*x509.Certificate
 
 	globalDomainNames []string      // Root domains for virtual host style requests